{"id":"CVE-2025-59954","summary":"Knowage Contains a Remote Code Execution Vulnerability","details":"Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.","aliases":["GHSA-96cv-75hg-xrgq"],"modified":"2026-08-12T15:14:13.920968Z","published":"2025-09-29T23:48:04.968Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59954.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59954.json"},{"type":"ADVISORY","url":"https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-96cv-75hg-xrgq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59954"},{"type":"FIX","url":"https://github.com/KnowageLabs/Knowage-Server/commit/1bb60d42557724f7ed24c19df6c5017e169527ca"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/knowagelabs/knowage-server","events":[{"introduced":"0"},{"fixed":"0c290bd8e774da1a0c9a2dd27dfcfcc385b82239"},{"fixed":"1bb60d42557724f7ed24c19df6c5017e169527ca"}],"database_specific":{"cpe":"cpe:2.3:a:eng:knowage:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.1.27"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v8.1.26","v8.1.25","v8.1.24","v8.1.23","v8.1.22","v8.1.21","v8.1.20","v8.1.19","v8.1.18","v8.1.17","v8.1.16","v8.1.15","v8.1.12","v8.1.11","v8.1.10","v8.1.9","v8.1.8","v8.1.7","v8.1.6","v8.1.3","v8.1.2","v8.1.1","v8.1.0","v7.2.0","v7.2.0-2020-04-06","v7.0.0-RC"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59954.json","vanir_signatures_modified":"2026-08-12T15:14:13Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"52758444889038208131805997160638615932","length":1252},"id":"CVE-2025-59954-04db5eca","signature_type":"Function","signature_version":"v1","source":"https://github.com/knowagelabs/knowage-server/commit/1bb60d42557724f7ed24c19df6c5017e169527ca","target":{"file":"knowagemeta/src/main/java/it/eng/knowage/meta/service/MetaService.java","function":"applyPatch"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["44075971946587904152112956513630267993","148601377089856599801457757948890561504","69591118000801098442539106955094862726","145529881423909868698008496825675237569","114800102287294133613258227070239543495","185509229059084553079967027770536602211","215818771743678495183630838385222443881","232500853601515916089205329319663445019","171165331608229871359773153408169261876","241552081217939125669632022204133208455","14995551366454467808827535896593658087","168073655530977358407974499050225101431","234368561008342432223937120539104174363"]},"id":"CVE-2025-59954-2a1b95fc","signature_type":"Line","signature_version":"v1","source":"https://github.com/knowagelabs/knowage-server/commit/1bb60d42557724f7ed24c19df6c5017e169527ca","target":{"file":"knowagemeta/src/main/java/it/eng/knowage/meta/service/MetaService.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"}]}